2db350d5b208ade1b8817b7d028303a5

Sharing

Copy URL Twitter E-mail

General

Target
2db350d5b208ade1b8817b7d028303a5
Size 83KB
Sample231219-qdc4caced7
SHA256 d39328454b0e6b3a5188b1431a9cc2d9fd1955da826a10bde29a51458cf57b91
MD5 2db350d5b208ade1b8817b7d028303a5
SHA1 b236198ecafccd6b8b48a362afb6816f225bfff5
SHA512 ea6f4a0dca5bf18164eec474cbd0023dbd4b9d408ade31e370d99a10474c324cc46cead7226ea761994058c36573a4a1886bb505b8482c2eeb70bc1be02cccec
SSDEEP 1536:6JBsQfVw75jfBrL28z5/fJ+RiDsWakvj1nr+:EaVjfBrLb/RkWsAxq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2db350d5b208ade1b8817b7d028303a5

File Explorer

2db350d5b208ade1b8817b7d028303a5

.exe 83KB

2db350d5b208ade1b8817b7d028303a5

IMPHASH cb55ef8ddff6ca096823fd960459bc3a
SHA256 d39328454b0e6b3a5188b1431a9cc2d9fd1955da826a10bde29a51458cf57b91
MD5 2db350d5b208ade1b8817b7d028303a5
SHA1 b236198ecafccd6b8b48a362afb6816f225bfff5
SHA512 ea6f4a0dca5bf18164eec474cbd0023dbd4b9d408ade31e370d99a10474c324cc46cead7226ea761994058c36573a4a1886bb505b8482c2eeb70bc1be02cccec
SSDEEP 1536:6JBsQfVw75jfBrL28z5/fJ+RiDsWakvj1nr+:EaVjfBrLb/RkWsAxq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileW FindFirstFileW FindClose FindNextFileW GetWindowsDirectoryW WaitForSingleObject GetModuleHandleW GetTickCount Sleep CreateProcessA GetModuleFileNameW GetStartupInfoA ReadFile GetFileSize DeleteFileA CreateThread GetProcAddress LoadLibraryA GetCurrentProcess GetLastError GetSystemInfo GetModuleHandleA GlobalAlloc GlobalFree GetTempFileNameA CreateFileA CloseHandle GetVersionExA CreateToolhelp32Snapshot GetDiskFreeSpaceA HeapReAlloc Process32Next GetCurrentDirectoryW GetSystemDirectoryA GetFileAttributesW GetVolumeInformationA OpenProcess GetDriveTypeA GetLogicalDrives Process32First GetDriveTypeW GetComputerNameA GetProcessHeap HeapFree HeapAlloc GetTempPathA GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetWindowRect GetWindowDC ReleaseDC GetDesktopWindow

gdi32

CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC BitBlt SelectObject

advapi32

GetTokenInformation OpenProcessToken GetUserNameA CreateWellKnownSid CheckTokenMembership DuplicateToken

shell32

SHGetFolderPathW ord680

ole32

CreateStreamOnHGlobal

ntdll

_snwprintf _wcsicmp sprintf memcpy memset

wininet

InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle HttpQueryInfoA InternetConnectA

iphlpapi

GetAdaptersInfo

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusStartup

psapi

GetModuleFileNameExA

mpr

WNetCloseEnum WNetOpenEnumW WNetEnumResourceW

Name

.text

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

332B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2db350d5b208ade1b8817b7d028303a5

kernel32

user32

gdi32

advapi32

shell32

ole32

ntdll

wininet

iphlpapi

gdiplus

psapi

mpr

generic